Corporate Phishing Incident Response Plan

Phishing is the crime type reported most often to the FBI: its Internet Crime Complaint Center (IC3) logged 191,561 phishing and spoofing complaints in 2025, and business email compromise, which often starts with a phished or spoofed mailbox, produced $3.05 billion in reported losses (IC3 2025 Internet Crime Report). Some phishing will get through any set of filters, so what matters is how quickly your organization recognizes a successful attack and limits it. A written, rehearsed incident response (IR) playbook for phishing is what makes that speed possible.

The reference framework is NIST SP 800-61 Revision 3, published in April 2025, which supersedes the 2012 Revision 2 and recasts incident response as part of cybersecurity risk management under the NIST Cybersecurity Framework (CSF) 2.0.

Why Phishing Needs Its Own IR Playbook

Generic incident response plans treat phishing as one scenario among many. But phishing incidents start with a human report or a filter alert, follow a fairly predictable chain (delivery, click, credential entry or malware execution, account misuse), and often turn into payment fraud. A dedicated playbook lets you triage quickly, escalate consistently and measure how well you are doing.

How NIST SP 800-61r3 Frames Incident Response

Revision 2 described a four-phase life cycle: Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity. Revision 3 replaces that model with the six CSF 2.0 Functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST maps the old phases onto the new Functions:

Familiar phase (SP 800-61r2)	CSF 2.0 Functions (SP 800-61r3)
Preparation	Govern, Identify, Protect
Detection and analysis	Detect, plus Identify (Improvement)
Containment, eradication and recovery	Respond, Recover, plus Identify (Improvement)
Post-incident activity	Identify (Improvement)

NIST’s reasoning is that incidents today are frequent, broad and can take weeks or months to recover from, so improvement has to be continuous: lessons learned “should often be shared as soon as they are identified, not delayed until after recovery concludes.” NIST also says organizations “should use the incident response life cycle framework or model that suits them best,” so the familiar phases below remain a practical playbook structure, as long as improvement happens throughout.

Phase 1: Preparation (Govern, Identify, Protect)

Preparation determines response speed. Before the first phishing email arrives:

Technical preparation:

Deploy email authentication (DMARC/SPF/DKIM) at enforcement
Configure the email gateway or platform protection with URL rewriting, sandboxing and attachment detonation
Turn on MFA for all accounts, preferably phishing-resistant (FIDO2 security keys or passkeys)
Centralize logging for email, authentication and endpoint activity, and confirm the retention period covers a realistic investigation
Put a phishing report button in every email client

People and process preparation:

Name a phishing triage owner and backup, with an on-call rotation
Define escalation criteria: when does a reported email become an incident?
Train employees to recognize and, above all, report phishing; see phishing simulation
Prepare communication templates and an out-of-band contact list in case email itself is compromised
Run regular tabletop exercises built on phishing scenarios, including a fraudulent payment request

Phase 2: Detection and Analysis (Detect)

Detection starts when a phishing email is reported by a user or flagged by automated systems.

Triage checklist:

Examine email headers for SPF, DKIM and DMARC results and the true sending infrastructure
Analyze URLs and attachments in a sandbox or with services such as VirusTotal and urlscan.io, remembering that submissions to public services can be visible to others; use private options for sensitive material
Check attachment hashes and domains against threat intelligence feeds
Determine whether anyone clicked the link, opened the attachment or entered credentials (proxy, DNS and sign-in logs)
Search mail logs for the same sender, subject or URL across the organization
Classify severity:

Severity	Criteria	Priority
Low	Reported, no one interacted	Handle in the normal queue
Medium	Users clicked but did not enter credentials or run files	Same day
High	Credentials entered, MFA approved, or malware executed	Immediately
Critical	Multiple compromised accounts, fraudulent payment, or data exfiltration	Immediately, with management and legal escalation

Set your own response-time targets for each level and write them into the playbook.

Phase 3: Containment (Respond)

The faster a compromised account or device is contained, the less an attacker can do with it.

Immediate containment actions:

Block the sender address or domain at the email gateway
Block the phishing URL at the web proxy and DNS filter
Remove unread copies of the phishing email from all mailboxes
Disable compromised accounts or force password resets
Revoke active sessions and OAuth tokens, because a password reset alone may not end a stolen session
Check for email forwarding rules and inbox rules added by the attacker

Network containment:

Isolate endpoints showing indicators of compromise
Block command-and-control (C2) IP addresses and domains at the firewall
Watch for lateral movement with endpoint detection and response (EDR)

If money moved: contact your bank immediately to request a recall, and file a complaint at ic3.gov with full transaction details. The IC3 Recovery Asset Team worked 3,900 incidents in 2025 and helped freeze $679 million of $1.16 billion in attempted theft, a 58% success rate, and the FBI stresses that “time is of the essence.”

Phase 4: Eradication (Respond)

Once the incident is contained, remove the threat:

Delete all copies of the phishing email from mail systems
Remove malware from affected endpoints, reimaging where necessary
Delete attacker-created accounts, forwarding rules, mailbox delegations and OAuth applications
Patch any vulnerabilities exploited during the attack
Update filtering rules to catch variations of the attack
Share indicators of compromise (IOCs) with your information-sharing community or sector ISAC

Phase 5: Recovery (Recover)

Restore normal operations with closer monitoring:

Re-enable accounts with new credentials and verified MFA
Restore systems from clean backups if they were compromised
Increase logging on previously affected systems for a defined period
Watch for re-compromise attempts using the same or similar techniques
Confirm with business owners that operations have fully resumed

Phase 6: Post-Incident Activity (Identify: Improvement)

Every incident should leave the organization better defended. Hold a lessons-learned review promptly, and record improvements as soon as they are identified rather than waiting for the meeting:

What was the attack vector and technique?
How was it detected: a user report, automated detection, or both?
How long did detection and containment take?
Which controls failed, and which worked?
What would make the response faster next time?

Update documentation and meet reporting duties:

Revise the playbook, detection rules and filtering policies
Adjust security awareness training to cover the technique that was used
Report to IC3 where there was financial loss, to CISA through its reporting form at cisa.gov/report, and to your sector ISAC
Check legal notification obligations with counsel. These vary by sector and state. For example, financial institutions covered by the FTC’s Safeguards Rule must notify the FTC no later than 30 days after discovering a notification event involving the information of at least 500 consumers (16 CFR 314.4(j)), and state breach-notification laws and sector rules such as HIPAA impose their own requirements

Metrics That Matter

Track these indicators to measure and improve your phishing IR capability. Set targets from your own baseline rather than borrowing someone else’s:

Metric	Why it matters
Time to first report	How quickly employees raise the alarm after delivery
Mean time to detect (MTTD)	Faster detection means less exposure
Mean time to contain (MTTC)	Containment speed limits account misuse and fraud
Reporting rate	The share of recipients who report a simulated or real phish
False positive rate	Too many benign reports cause alert fatigue; route them efficiently rather than discouraging reports
Repeat compromise	Accounts or users involved in more than one incident point to control gaps

Reporting is the metric to protect. Independent research has found that training itself moves click rates only slightly, so the speed at which people report is often more useful than the click rate (Ho et al., IEEE S&P 2025).

Scaling for Small Businesses

Small businesses without a security team can still respond effectively. See our small business phishing guide for scaled-down procedures. Key adaptations:

Designate one person, and a backup, as the phishing point of contact
Use the built-in protections of your cloud email provider (such as Microsoft Defender for Office 365 or Google Workspace security)
Arrange incident support in advance with a managed security service provider (MSSP)
Keep a one-page quick-response card with who to call, how to reset accounts and how to contact the bank

Key Takeaways

Phishing/spoofing was the most-reported crime type to IC3 in 2025, and BEC produced $3.05 billion in reported losses
NIST SP 800-61r3 (April 2025) frames incident response around the CSF 2.0 Functions; the familiar phases still work as a playbook structure
Severity classification enables proportional response; set your own time targets
Revoke sessions and tokens, not just passwords, and call the bank immediately if money moved
Treat improvement as continuous, and check notification duties such as the FTC Safeguards Rule’s 30-day requirement
Small businesses can run effective phishing IR with a named contact, built-in tools and a pre-arranged MSSP

For the comprehensive phishing defense overview, see our phishing recognition and reporting guide.

Sources

Security education disclaimer: This article discusses incident response procedures for educational purposes. Organizations should adapt these guidelines to their specific environment, regulatory requirements, and risk profile. Consult a qualified cybersecurity professional for implementation.